CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 29, 2026, 12:23 PM ET)

What this means for you

This week: 3,329 CVEs published, 274 critical, and 3 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,329; Show in the list
Critical, last 7 days: 274; Show in the list
Healthcare-tagged, last 7 days: 10; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product veeam:veeam_backup_&_replication. Show all products

17 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2022-26501 Known exploited	Critical 9.8	Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). Assigned by mitre	Mar 17, 2022
CVE-2022-26500 Known exploited	High 8.8	Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and exec… Assigned by mitre	Mar 17, 2022
CVE-2023-27532 Known exploited	High 7.5	Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. Assigned by hackerone	Mar 9, 2023
CVE-2024-40711 Known exploited	Critical 9.8	A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE). Assigned by hackerone	Sep 7, 2024
CVE-2025-48984	High 8.8	A vulnerability allowing remote code execution (RCE) on the Backup Server by an authenticated domain user. Assigned by hackerone	Oct 30, 2025
CVE-2025-48983	Critical 10.0	A vulnerability in the Mount service of Veeam Backup & Replication, which allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user. Assigned by hackerone	Oct 30, 2025
CVE-2025-59470	Critical 9.0	This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or order parameter. Assigned by hackerone	Jan 8, 2026
CVE-2025-59469	Critical 9.0	This vulnerability allows a Backup or Tape Operator to write files as root. Assigned by hackerone	Jan 8, 2026
CVE-2025-55125	High 7.8	This vulnerability allows a Backup or Tape Operator to perform remote code execution (RCE) as root by creating a malicious backup configuration file. Assigned by hackerone	Jan 8, 2026
CVE-2025-59468	Critical 9.0	This vulnerability allows a Backup Administrator to perform remote code execution (RCE) as the postgres user by sending a malicious password parameter. Assigned by hackerone	Jan 8, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.